LND P2P Connection Flooding File-Descriptor Exhaustion

Impact

An attacker could exhaust a victim lnd node’s available file descriptors by opening a large number of inbound connections that do not correspond to any shared channel. Because lnd imposed no limit on concurrent non-channel peer connections, an attacker could hold many connections open indefinitely. Once the file-descriptor limit was reached, the node could no longer open files, accept or initiate connections, or perform other file-system operations, rendering it effectively non-functional until restarted.

There is no fund-loss path. Restarting the node clears the excess connections, but the attack can be immediately resumed.

Severity

Scored against the Lightning Labs severity taxonomy (4-dimension rubric):

Dimension	Score	Reasoning
Impact	Low	File-descriptor exhaustion and associated service unavailability. The node restarts cleanly; no fund-loss path.
Attack Vector	High	Network. Any peer can initiate inbound TCP connections with no prior relationship or shared channel.
Exploitability	High	Opening TCP connections requires no special capability; saturating the OS file-descriptor limit is straightforward.
Virality	Low	Per-victim. The attacker must establish and hold connections to each target; the attack does not propagate through the network.

Result: T3. Rule 3 (Impact = Low, base T3); no promotion because Virality is not High.

Patches

The issue was fixed in lnd v0.19.0-beta by introducing a global limit on inbound non-channel peer connections. Users should update to v0.19.0-beta or later to be protected. Node operators running large routing nodes are also recommended to set their OS-level open-file limit (ulimit -n) appropriate to their expected peer count.

Disclosure timeline

• Identified internally by the Lightning Labs security team.
• Fix merged and released in lnd v0.19.0-beta.
• Public disclosure: 2026-08-11.